AWS Releases Dogwood to Enforce Rules Across Sequences of Agent Actions

AWS has unveiled Dogwood, an open-source policy language that builds on its existing Cedar framework to govern not just individual agent actions, but entire workflows. Where Cedar examines requests one at a time, Dogwood can look backward through the chain of tool calls an agent has already made—a shift that unlocks control over sequences like "obtain approval before executing" or "halt external calls after accessing sensitive information."

How it extends Cedar#

Cedar, which AWS contributed to the CNCF, works by stateless evaluation: the same input always yields the same permit-or-deny decision, regardless of history. This simplicity enables formal verification and auditability, but leaves whole classes of constraints beyond reach. Real agent workflows, though, often need stateful rules—ones that track cumulative effects, ordering dependencies, or running totals.

Dogwood adds a new clause type called when temporal alongside Cedar's existing when conditions. Rather than checking only the current request, a temporal condition reads into the agent's event log, examining prior tool calls and their outcomes. The language ships with four operators implemented as macros over a core Metric First-Order Temporal Logic subset: formerly (whether something occurred in a window), count_within (frequency), count_distinct_within (cardinality), and sum_within (running totals). A bind operator lets the policy reference an aggregate value in the current decision.

The concurrency trap#

The release highlights a pitfall that distributed-systems practitioners will recognize immediately. A rate-limit policy that sums response events (completed transfers) can be bypassed by concurrency, because three parallel $2,000 calls may all clear before any settles, evading a $5,000 cap. The same policy written against request events sees all three in flight and correctly denies the third. One word of difference; wildly different outcomes. Agents routinely issue parallel tool calls, and multi-agent systems compound the interleaving problem further.

Production readiness and constraints#

AWS is candid about the tradeoffs. Temporal evaluation requires stateful event tracking, and evaluation time can scale with log length. More critically, temporal conditions forfeit the automated reasoning capabilities that Cedar's static policies enable—teams cannot formally verify a ruleset mixing temporal logic.